Docker Image Security Analysis and Testing

Docker Image Security Analysis and Testing

When performing security assessments of Docker containers, having local access to container images provides significant advantages. This guide focuses on the security analysis and testing aspects of Docker containers, showing you how to perform thorough security assessments of container images.

Why Perform Local Security Analysis?

Comprehensive security testing

• Local access enables thorough security testing without network constraints or external dependencies. This is crucial when performing detailed vulnerability assessments or penetration testing of container images.

Forensic analysis capabilities

• Having the container image locally allows for in-depth forensic analysis of container layers, installed packages, configurations, and potential embedded secrets.

Isolated testing environment

• Local testing environments allow you to modify and test images without affecting production systems, crucial for security assessments where modifications might trigger security alerts.

Detailed vulnerability scanning

• Local access means you can perform comprehensive vulnerability scanning without being subject to rate limiting from registries or API endpoints.

Setting Up a Secure Testing Environment

1. Create Isolated Network

# Create dedicated docker network for testing
docker network create --internal pentest-network

This creates an internal network that has no external access, providing isolation for your testing environment.

2. Basic Container Analysis Setup

# Run with security analysis tools mounted
docker run -it \
  --name analysis-container \
  --network pentest-network \
  -v /path/to/tools:/tools \
  --cap-add=SYS_PTRACE \
  target_image:tag

3. Common Analysis Options

Forensic Analysis Techniques

Layer Analysis

Extract filesystem layers for detailed examination:

# Extract image layers
mkdir image-analysis
cd image-analysis
docker save image_name:tag | tar -xv

This command sequence allows you to dig deep into the internals of a Docker image. Here’s what’s happening:

1. First, docker save exports the entire image as a tar archive
2. The pipe (|) feeds this directly into tar -xv which extracts all layers
3. Each layer contains a full filesystem snapshot at that build stage

After extraction, you’ll find a /blobs directory which contains:

• Filesystem changes for each layer
• Binary and text files added during image building
• Modified configuration files
• Application code and dependencies
• System libraries and executables

Analyzing Layer Contents

Each blob in /blobs/sha256/ is a tar archive that can be analyzed:

# Navigate to the blob directory
cd blobs/sha256/

# Extract contents of a specific layer
mkdir layer_contents
tar xf <blob-hash> -C ./layer_contents

# Search for specific file types
tar tvf <blob-hash> | grep "\.conf$"

# Search for sensitive information
tar xf <blob-hash> --to-stdout | strings | grep -ie "password\|user\|cred"

# Extract and analyze specific files
tar xf <blob-hash> layer/etc/passwd --to-stdout | grep -ie "root"

Pro Tips:

• For binary files, always extract first, then analyze
• The --to-stdout option is more reliable than -O for text extraction
• Use strings command selectively as it might miss encoded/compressed data

Security Assessment Techniques

1. Image History Analysis

The docker history command is a powerful tool for security analysis:

# Get complete build history
docker history --no-trunc image_name:tag

# Export for later analysis
docker history --no-trunc image_name:tag > imageHistory.txt

# Search for sensitive information
docker history --no-trunc image_name:tag | grep -ie "pass\|user\|cred"

This can reveal sensitive information such as:

• Environment variables containing credentials
• Installation commands with version numbers
• Temporary files or credentials in earlier layers
• Internal URLs and repository information
• Usernames and working directories

For example, you might find exposed credentials in the history:

RUN curl -u admin:SuperSecret123 http://internal-repo.company.local/setup.sh | bash

2. Configuration Analysis

# Export container configuration
docker inspect image_name:tag > container_config.json

# Check for sensitive mounts or environment variables
jq '.Config.Env, .HostConfig.Binds' container_config.json

3. Package and Dependency Analysis

# List installed packages
docker run --rm image_name:tag dpkg -l  # For Debian-based
docker run --rm image_name:tag rpm -qa  # For RPM-based

# Check for known vulnerabilities
docker run --rm -v /var/run/docker.sock:/var/run/docker.sock aquasec/trivy image_name:tag

Documentation and Reporting

Maintain detailed documentation of your findings:

# Document original image state
docker inspect image_name:tag > original_image_info.json
docker history image_name:tag > image_history.txt

# Document running processes and open ports
docker top container_name
docker port container_name

Cleanup Procedures

Always clean up after security testing:

# Remove all test containers
docker rm -f $(docker ps -aq)

# Remove test images
docker rmi -f target_image:tag

# Remove test network
docker network rm pentest-network

# Securely delete sensitive files
shred -u target_image.tar
rm -rf image-analysis/

Best Practices

1. Always work in isolated environments
2. Document all findings and modifications
3. Use proper version control for modified images
4. Implement proper secret management
5. Follow the principle of least privilege
6. Clean up thoroughly after testing